SECURE SERVICE MANAGEMENT IN A COMMUNICATION NETWORK

• US 20150010152A1
• Filed: 07/08/2013
• Published: 01/08/2015
• Est. Priority Date: 07/08/2013
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Alcatel-Lucent Canada Incorporated (Nokia Corporation)
• Inventors: Rajsic, Carl, Proulx, Denis A.
• Granted Patent: US 9,825,759 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065

Abstract

In one embodiment, a tunnel to be affected by configuration of a service in a network is identified and key information for the identified tunnel is obtained from a corresponding router. The tunnel is assigned to a key group based on the key information, and provisioning information associated with the tunnel on the router is updated based on the assigned key group in conjunction with configuration of the service. The updating of the provisioning information may comprise altering the key information on the router to include a key associated with the assigned key group. Also, one or more keys not associated with the assigned key group may be deleted from the router and from a management entity of the network.

Claims

1. A method comprising:

identifying a tunnel to be affected by configuration of a service in a network;

obtaining key information for the identified tunnel from a corresponding router;

assigning the tunnel to a key group based on the key information; and

updating provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service.

2. The method of claim 1 wherein identifying the tunnel comprises:

identifying a plurality of routers to be affected by configuration of the service in the network; and

identifying a plurality of tunnels associated with the identified routers that will be affected by configuration of the service in the network.

3. The method of claim 2 wherein the obtaining, assigning and updating are repeated for each of the identified tunnels.

4. The method of claim 1 wherein obtaining key information comprises receiving one or more key identifiers from the router.

5. The method of claim 4 wherein assigning the tunnel to a key group based on the key information comprises:

identifying a plurality of key groups that each include at least one of the received key identifiers; and

assigning the tunnel to a selected one of the identified key groups.

6. The method of claim 5 wherein selection of a particular one of the identified key groups is based on a number of routers associated with that key group.

7. The method of claim 1 wherein updating provisioning information comprises altering the key information on the router to include a key associated with the assigned key group.

8. The method of claim 7 further comprising deleting from the key information one or more keys not associated with the assigned key group.

9. The method of claim 1 wherein updating provisioning information comprises updating a service access point entry on the router to replace a key identifier with a key group identifier.

10. The method of claim 1 further comprising deleting from a management entity one or more keys not associated with any assigned key group.

11. The method of claim 5 wherein the plurality of key groups comprise a first key group associated with first set of enterprise resources having a first level of security and a second key group associated with a second set of enterprise resources having a second level of security different than the first level of security.

12. The method of claim 11 wherein the first key group comprises a control key group associated with one or more network operations centers of a utility and the second key group comprises one of a transmission key group associated with transmission infrastructure of the utility and a distribution key group associated with distribution infrastructure of the utility.

13. The method of claim 1 wherein the key group comprises a plurality of keys including at least one encryption key and at least one authentication key.

14. An article of manufacture comprising a computer-readable storage medium having embodied therein executable program code that when executed by at least one processing device causes said at least one processing device to:

identify a tunnel to be affected by configuration of a service in a network;

obtain key information for the identified tunnel from a corresponding router;

assign the tunnel to a key group based on the key information; and

update provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service.

15. A service platform comprising:

an interface for communicatively coupling to a network management entity; and

a service database for storing a plurality of key groups;

wherein the service platform is configured to execute at least one service application that in cooperation with the network management entity;

identifies a tunnel to be affected by configuration of a service;

obtains key information for the identified tunnel from a corresponding router;

assigns the tunnel to a key group based on the key information; and

updates provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service.

16. A communication network comprising the service platform of claim 15.

17. The communication network of claim 16 wherein the network comprises a Multiple Protocol Label Switching (MPLS) network.

18. The communication network of claim 16 wherein the router comprises a provider edge router of the network.

19. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

wherein said at least one processing device is configured to identify a tunnel to be affected by configuration of a service in a network, to obtain key information for the identified tunnel from a corresponding router of the network, to assign the tunnel to a key group based on the key information, and to update provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service.

20. The apparatus of claim 19 wherein said at least one processing device implements a service platform adapted for communication with a network management entity of the network.